Terraform 5: The core workflow — init, plan, apply, destroy
easy⏱ 5 mincourseterraform
init: download providers, set up the backend
terraform init reads required_providers, downloads provider plugins into .terraform/, and configures the backend (where state lives). Run it once per working directory and again whenever you add a provider or change the backend. It touches no real infrastructure.
# In the directory with your .tf files
terraform init
# Initializing the backend...
# Initializing provider plugins...
# - Installing hashicorp/azurerm v3.100.0...
# Terraform has been successfully initialized!
plan: preview the changes
terraform plan compares your config against state and the real world, then prints the exact create/update/delete actions without applying them. Save it with -out so apply executes precisely that plan — no drift between what you reviewed and what runs.
terraform plan -out=tfplan
# Plan: 2 to add, 0 to change, 0 to destroy.
# Saved the plan to: tfplan
apply and destroy: change the world
terraform apply executes the plan and updates state. terraform destroy removes everything the config manages. Both prompt for confirmation unless you pass -auto-approve (reserve that for CI, never a shared prod terminal).
# Apply the saved plan (no second prompt when a plan file is given)
terraform apply tfplan
# Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
# Tear it all down
terraform destroy
# Plan: 0 to add, 0 to change, 2 to destroy.
Only apply and destroy mutate reality
init and plan are safe/read-only; apply and destroy change real infrastructure and state. Golden rule: never apply a plan you didn't just read. In CI, plan -out on the PR and apply that saved file on merge.
Model the workflow pipeline
Create workflow, an ordered array of { command: string; mutates: boolean } for init, plan, apply, destroy. Log the commands that mutate infrastructure, in pipeline order, comma-separated (expect apply, destroy).